Fallback to Provider Password if Keycloak internal password is wrong

[daniel-frak]

Fallback to Provider Password if Keycloak internal password is wrong

[daniel-frak]

I think your problem is effectively the same as in this issue:
#137 (comment)

As explained there, once the user is found and the password is validated, the link to the legacy system is severed. Afterwards, Keycloak will not call the legacy system for that user anymore.

What you need could possibly be achieved by not severing the link at that point. However, to quote my own comment:

You'd have to figure out at what other point you want to sever the link, though (I assume you want to turn off your old auth system eventually), and keep in mind that AFAIK this will make it so that the password will NOT be checked on Keycloak's side (so changing the password in Keycloak won't work until you sever the link).

[theomega]

Thanks @daniel-frak , that totally makes sense, thanks for the explanation. I tried searching the issues, but didn't find that one. Maybe we should add this to the README, so that people know what to expect and save you from answering the same question again?

[daniel-frak]

That sounds like a great idea!

Do you want to make a PR for the README update?

[daniel-frak]

I've updated the docs to clarify the consequences of the link being severed.
Let me know if there's anything else you were thinking about adding there.